[YOUR PRODUCT NAME] Privacy Policy

Effective Date: July 10, 2026

Last Updated: July 21, 2026

1. Introduction

Welcome to [YOUR PRODUCT NAME] ("we," "our," "us," or the "Company"). [YOUR PRODUCT NAME] operates an online marketplace platform accessible at https://[your-domain.example] (the "Platform") that connects buyers and sellers of software businesses, including SaaS products, AI tools, mobile applications, APIs, Chrome extensions, developer tools, and source code businesses.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you access or use the Platform. By using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy.

If you do not agree with this Privacy Policy, please do not access or use the Platform.

2. Information We Collect

We collect information that you provide directly to us, information collected automatically when you use the Platform, and information from third-party sources.

2.1 Information You Provide Directly

Account Information. When you register for an account, we collect your name, email address, and authentication credentials. If you sign up using Google OAuth, we receive your name and email address from Google in accordance with Google's privacy practices.

Profile Information. You may choose to provide additional information for your profile, such as a display name or biography.

Listing Content. If you create a listing as a seller, we collect business details including the business name, description, industry category, operational metrics, financial information you choose to disclose, cover images, and the asset URL (the web address of the business being sold). Listings you create are user-generated content.

Inquiries and Communications. When you contact a seller or respond to an inquiry, we collect the content of those messages.

Offer and Negotiation Data. When you make an offer, counter an offer, or participate in negotiations, we collect the offer amount, terms, status history, and related negotiation records.

Acquisition Data. When an offer is accepted and an acquisition is created, we collect records of the agreed price, the identities of the buyer and seller, and the status of the acquisition.

Data Room Documents. If you are a seller, you may upload due diligence documents to the Private Data Room associated with your listing. If you are a buyer with an active acquisition, you may access documents shared in the Private Data Room. We collect and store these documents and associated metadata.

Verification Information. When you verify an asset (for example, by verifying domain ownership), we collect the verification method used and the verification result.

2.2 Information Collected Automatically

Usage Data. We collect information about how you interact with the Platform, including pages visited, features used, search queries, filters applied, and the dates and times of your activities.

Device and Log Information. We collect information about the device and browser you use to access the Platform, including IP address, browser type, operating system, and device identifiers.

Server and Edge Logs. The Platform is served through Cloudflare Workers, which automatically collects request metadata including IP address, request URL, HTTP method, response status code, request timing, geographic location (country, region, city derived from IP), TLS version, and user agent. These logs are retained for operational monitoring, debugging, and security purposes. Log data is retained for up to 30 days and is not used for advertising or user profiling.

Password Security Check. During account creation, we check your chosen password against known data breach databases using a privacy-preserving protocol (k-anonymity). Only a partial hash prefix of your password is transmitted to the breach database provider (Have I Been Pwned); your full password is never sent to any third party. This check is performed solely to protect your account security.

Cookies and Similar Technologies. We use cookies and similar tracking technologies to operate and secure the Platform, remember your preferences, and understand usage patterns. See Section 9 for more details.

2.3 Information from Third Parties

We may receive information about you from third-party authentication providers (such as Google) when you choose to sign in using those services. The information we receive is governed by the privacy settings you have established with those providers.

2.4 Account Deletion Audit Records

When you request account deletion, we retain a compliance audit record in our systems. This record includes your email address (retained until your deletion confirmation email is delivered, then replaced with a masked version), the IP address and device information recorded at the time you submitted the deletion request (retained for 12 months, then permanently removed), and timestamps of each processing stage. This record is retained permanently to demonstrate that your deletion request was received, processed, and completed. It contains no personally identifying information after the minimization steps above are applied.

3. How We Use Your Information

We use the information we collect for the following purposes:

To Provide and Operate the Platform. We use your information to create and manage your account, display listings, facilitate inquiries, process offers and negotiations, manage acquisitions, and operate the Private Data Room.

To Verify Assets. We use verification information to confirm objective claims about listed assets, such as domain ownership, and to display trust signals on listings.

To Communicate with You. We use your contact information to send you service-related communications, including account notifications, security alerts, updates to our terms or policies, and responses to your support requests.

To Ensure Security. We use your information to detect, prevent, and address fraud, unauthorized access, abuse, and other harmful activity.

To Improve the Platform. We analyze usage data to understand how users interact with the Platform and to improve our features, performance, and user experience.

To Comply with Legal Obligations. We use your information as necessary to comply with applicable laws, regulations, legal processes, and enforceable governmental requests.

4. Legal Basis for Processing

If you are located in a jurisdiction that requires a legal basis for processing personal data (such as the European Economic Area or the United Kingdom), our legal basis for collecting and using your personal information depends on the specific context in which we collect it. We normally rely on the following legal bases:

• Performance of a contract: Processing is necessary to perform our contract with you (our Terms of Service) or to take steps at your request before entering into a contract.
• Legitimate interests: Processing is necessary for our legitimate interests, such as operating and improving the Platform, ensuring security, and preventing fraud, provided those interests are not overridden by your rights.
• Consent: Where required by law, we rely on your consent for specific processing activities (for example, for certain types of cookies or marketing communications).
• Legal obligation: Processing is necessary to comply with a legal obligation to which we are subject.

5. How We Share Your Information

We do not sell your personal information. We only share your information in the following circumstances:

5.1 With Other Platform Users

During Active Acquisitions. When a seller accepts a buyer's offer and an acquisition is created, we share specific information between the buyer and seller to facilitate the transaction. This includes:

• The buyer's name with the seller.
• The seller's listing details with the buyer.
• Documents uploaded to the Private Data Room.

Access to the Private Data Room is strictly gated by the active status of the acquisition. If the acquisition is cancelled, buyer access to the Data Room is revoked.

After Account Deletion. If a participant in a historical transaction deletes their account, their identity is removed from those transaction records. The other participant retains the transaction history (amounts, dates, and status) without personally identifying information for the deleted party.

Public Listings. Information included in a published listing (such as the business description, industry, and public trust signals) is visible to all users and visitors of the Platform.

Inquiries. When you send an inquiry to a seller, the seller can see your name and the content of your message.

5.2 With Service Providers

We share information with trusted third-party vendors and service providers who assist us in operating the Platform, including:

• Cloud hosting and infrastructure providers (Cloudflare Workers for application delivery, edge computing, and request logging).
• Database and storage providers (Supabase for authentication, data storage, and file storage).
• Authentication service providers (Google OAuth for third-party sign-in).
• Email and communication service providers (Resend for transactional email delivery).
• Analytics providers (Google Analytics for aggregate usage data).

These service providers are contractually bound to use your information only for the purposes of providing services to us and in accordance with this Privacy Policy.

5.3 For Legal Reasons

We may disclose your information if required to do so by law or in response to valid requests by public authorities (such as a court or government agency). We may also disclose your information if we believe in good faith that disclosure is necessary to:

• Enforce our Terms of Service or other agreements.
• Protect the rights, property, or safety of [YOUR PRODUCT NAME], our users, or the public.
• Detect, prevent, or otherwise address fraud, security, or technical issues.

5.4 Business Transfers

If [YOUR PRODUCT NAME] is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.3 via Cloudflare's global network.
• Application delivery through Cloudflare Workers with DDoS protection and edge security.
• Row-Level Security (RLS) enforced at the database layer, ensuring users can only access their own data.
• Access controls limiting who can access personal information within our organization.
• Structured observability and logging through Cloudflare Workers for rapid incident detection and response.
• Regular review of our information collection, storage, and processing practices.
• Physical and logical security measures for our hosting environment.

However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including to satisfy any legal, accounting, or reporting requirements.

• Account Information: Retained for the duration of your account. When you request account deletion, your personal information is removed within 12 hours of your request. See Section 8 for details on the deletion process.
• Listing Content: When your account is deleted, all your listings are archived and removed from public access. Archived listing records are retained internally for audit purposes with your seller identity removed.
• Inquiries: Permanently deleted when your account is deleted.
• Offers and Acquisition Records: Anonymized when your account is deleted. Financial amounts, timestamps, and transaction status are retained without any personally identifying information, to preserve marketplace transaction integrity.
• Data Room Documents: Permanently deleted (both files and database records) when your account is deleted.
• Uploaded Images and Files: All user-owned files stored on our platform are permanently deleted when your account is deleted.
• Deletion Audit Record: A compliance audit record of your deletion request is retained permanently. After your deletion is complete, this record contains only a masked email address, processing timestamps, and anonymized identifiers. It contains no directly identifying personal information. See Section 2.4 for details.

When we no longer need your personal information for any other purpose, we will securely delete or anonymize it in accordance with applicable law.

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information. These may include:

• Access: The right to request copies of your personal information.
• Correction: The right to request that we correct inaccurate or incomplete information.
• Deletion: The right to request that we delete your personal information in certain circumstances.
• Restriction: The right to request that we restrict the processing of your information.
• Data Portability: The right to receive your information in a structured, commonly used format.
• Objection: The right to object to our processing of your information based on legitimate interests.
• Withdraw Consent: Where we rely on consent, the right to withdraw consent at any time.

8.1 Self-Service Account Deletion

You may request permanent deletion of your account directly from your Account Settings page under Danger Zone. The process works as follows:

1. You initiate a deletion request from Settings. Before the request is accepted, the Platform checks that you have no active acquisitions, pending offers, or published listings. If any of these exist, you will be shown what needs to be resolved first. 2. Once confirmed, your account enters a pending deletion state and all active sessions are immediately revoked. 3. You will receive a confirmation email containing a link to cancel the request if you change your mind. 4. Your account will be permanently deleted within 12 hours of your request. 5. During the 12-hour window, you may cancel the deletion using the link in your email. 6. Once deletion is complete, it cannot be reversed under any circumstances.

What happens to your data on deletion:

• Your profile and account credentials are permanently removed.
• Your saved listings are deleted.
• Your uploaded data room documents and files are permanently deleted.
• Your listing cover images and all other uploaded files are deleted.
• Your message inquiries are deleted.
• Historical offer and acquisition records involving you are anonymized — financial amounts and dates are retained without your identity to preserve transaction integrity.
• A compliance audit record is retained as described in Section 2.4.

For data portability requests or other privacy rights not covered by the self-service deletion tool, contact us at [privacy@your-domain.example]. We will respond to your request within the timeframe required by applicable law.

Please note that certain information may be exempt from deletion requests if we need to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your browsing activities on the Platform.

Essential Cookies. These cookies are necessary for the Platform to function and cannot be disabled. They enable core functionality such as security, account authentication, and session management. [YOUR PRODUCT NAME] uses Supabase authentication cookies (prefixed `sb-`) for this purpose.

Analytics Cookies. These cookies help us understand how visitors interact with the Platform by collecting and reporting information. [YOUR PRODUCT NAME] uses Google Analytics, which sets cookies (prefixed `_ga`) to collect anonymous usage data. This data helps us improve the Platform's features and performance.

You can control cookies through your browser settings. However, if you disable essential cookies, you will not be able to sign in or use authenticated features of the Platform. Disabling analytics cookies will not affect Platform functionality.

For a full description of the cookies used on the Platform, their purpose, and how to manage them, please see our Cookie Policy.

10. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country.

We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy, including by entering into standard contractual clauses approved by relevant regulatory authorities where required.

11. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information as soon as possible. If you believe we may have collected information from a child under 18, please contact us immediately.

12. Third-Party Links and Services

The Platform may contain links to third-party websites or services that are not owned or controlled by [YOUR PRODUCT NAME]. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites or services you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Platform and updating the "Last Updated" date at the top of this page. We may also provide additional notice through the Platform or by email.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

[YOUR PRODUCT NAME]

Email: [privacy@your-domain.example]

By using the [YOUR PRODUCT NAME] Platform, you acknowledge that you have read and understood this Privacy Policy.